Accredited ACH Professional (AAP) — Questions and Answers

Question 1: The Gateway Operator role in international ACH is performed by:

The U.S. Treasury Department
FinCEN as the international compliance gatekeeper
NACHA exclusively as the global network administrator
An ODFI or RDFI that transmits or receives entries across national borders (Correct answer)

Correct answer: An ODFI or RDFI that transmits or receives entries across national borders

A Gateway Operator is an ODFI or RDFI that transmits ACH entries to or receives them from a financial agency outside the United States.

Question 2: Prenotification (prenote) entries sent before live dollar ACH entries allow an Originator to:

Test the validity of a Receiver's account information before sending live transactions (Correct answer)
Reserve settlement funds at the RDFI in advance
Notify the RDFI of an upcoming high-value transaction for review
Pre-authorize a payment that will be debited on a specific future date

Correct answer: Test the validity of a Receiver's account information before sending live transactions

A prenote is a zero-dollar test entry that validates account and routing numbers before the Originator begins sending live dollar entries to that account.

Question 3: According to Reg E, a financial institution must provide notification to a consumer within ___ day(s) of preauthorized transfer.

2 business days (Correct answer)
45 calendar days
10 calendar days
1 business day

Correct answer: 2 business days

According to Regulation E, financial institutions must provide notification to a consumer within two business days of a preauthorized transfer. This rule ensures consumers are promptly informed about transactions affecting their accounts. This notification helps consumers monitor their finances and identify any unauthorized activity quickly.

Question 4: Before originating entries for a new Originator, an ODFI is required by NACHA rules to:

Notify the RDFI in advance of the first entry
Conduct a risk assessment and due diligence review of the Originator (Correct answer)
File a report with FinCEN about the new relationship
Obtain pre-approval from NACHA

Correct answer: Conduct a risk assessment and due diligence review of the Originator

NACHA rules require ODFIs to perform due diligence and a risk assessment of new Originators before transmitting entries on their behalf.

Question 5: The second step in the risk management process is analyzing loss exposures. Which one of the following is true regarding this step? Choose one answer.

A major strength of loss exposure analysis is that the process is generally inexpensive.
Loss exposures that could interfere with the achievement of the organization's goals are identified in this step.
Loss exposures are analyzed based on loss frequency, loss severity, total dollar losses, and timing in this step. (Correct answer)
A weakness of loss exposure analysis is that it is useful only for those types of losses that an organization has suffered in the past.

Correct answer: Loss exposures are analyzed based on loss frequency, loss severity, total dollar losses, and timing in this step.

The second step in the risk management process, analyzing loss exposures, involves a detailed quantitative and qualitative assessment of identified risks. This analysis specifically focuses on four critical dimensions: loss frequency (how often a loss is expected), loss severity (the potential financial impact of each loss), total dollar losses (the aggregate financial burden), and timing (when losses are likely to occur). This comprehensive evaluation helps in understanding the true impact of potential risks.

Question 6: A zero-dollar account verification entry sent before initiating WEB debits is used to:

Calculate the Receiver's available credit limit for debit transactions
Reserve settlement capacity at the ACH Operator in advance
Verify that the Receiver's account is open and the account number is valid (Correct answer)
Confirm the Receiver's identity with NACHA's verification registry

Correct answer: Verify that the Receiver's account is open and the account number is valid

Zero-dollar verification entries (a form of prenote for WEB entries) confirm that the routing and account numbers are valid and the account is open before initiating live debit transactions.

Question 7: Which record type code identifies an ACH Addenda Record?

6
5
8
7 (Correct answer)

Correct answer: 7

Record type code '7' identifies Addenda Records, which provide supplemental payment-related information attached to an Entry Detail Record.

Question 8: What is a Notification of Change (NOC) in the ACH Network, and how should it be handled?

A request for additional payment information; it must be acknowledged by the RDFI within 2 business days.
An alert that a transaction failed; the ODFI must investigate and retransmit the entry within 24 hours.
A warning that funds have been reversed; it must be processed immediately.
A message sent by the RDFI to the ODFI to correct or update information; the Originator must make changes within 6 banking days or before the next payment cycle. (Correct answer)

Correct answer: A message sent by the RDFI to the ODFI to correct or update information; the Originator must make changes within 6 banking days or before the next payment cycle.

A Notification of Change (NOC) is an electronic message sent by the Receiving Depository Financial Institution (RDFI) to the Originating Depository Financial Institution (ODFI) to correct or update incorrect or outdated information for a Receiver's account. Upon receiving an NOC, the Originator is mandated by Nacha Rules to make the necessary changes to their records within six banking days or before the next scheduled entry, whichever is later, to ensure future entries are processed accurately.

Question 9: Which SEC code covers ACH debit entries to consumer accounts where authorization is obtained at the point of sale via a debit card transaction?

BOC (Back Office Conversion)
WEB (Internet-Initiated Debit)
POS (Point-of-Sale) (Correct answer)
POP (Point-of-Purchase)

Correct answer: POS (Point-of-Sale)

POS (Point-of-Sale) is the SEC code for consumer debit transactions initiated at the point of sale using a debit card or similar access device.

Question 10: NACHA Operating Rules require ODFIs to monitor their Originators primarily for which key compliance metric?

Daily entry count compared to the Originator's origination limit
Return rates—specifically the unauthorized debit return rate and the overall debit return rate (Correct answer)
Average transaction dollar amount relative to industry benchmarks
Consumer complaint ratio reported to the CFPB

Correct answer: Return rates—specifically the unauthorized debit return rate and the overall debit return rate

ODFIs must monitor Originator return rates, because excessive overall or unauthorized return rates indicate compliance problems that require ODFI intervention.

Question 11: Risk management program goals are typically divided into two categories: pre-loss goals and post-loss goals. Which one of the following describes one of these categories of goals? Choose one answer.

Pre-loss goals include profitability, earnings stability, and loss prevention.
Pre-loss goals are risk management goals that allow the organization to prepare for future losses.
Post-loss goals broadly describe the degree of recovery that an organization will strive to reach following a loss. (Correct answer)
Post-loss goals include immediate restoration of operations, tolerable uncertainty, and loss mitigation.

Correct answer: Post-loss goals broadly describe the degree of recovery that an organization will strive to reach following a loss.

Risk management goals are typically categorized into pre-loss and post-loss objectives. Post-loss goals specifically define the desired state of an organization after a loss event has occurred. These goals aim to guide the recovery process, ensuring the organization can survive, maintain operations, and achieve a certain level of stability and normalcy following an adverse incident.

Question 12: Which party in the ACH network bears ultimate responsibility for the actions of a Third-Party Sender?

The ACH Operator
The ODFI (Correct answer)
The Receiver's bank
NACHA

Correct answer: The ODFI

The ODFI is ultimately responsible for the actions of its Third-Party Senders and must ensure their compliance with NACHA Operating Rules.

Question 13: NOC change code C05 indicates:

Incorrect transaction code (Correct answer)
Incorrect company name
Incorrect DFI account number
Incorrect routing/transit number

Correct answer: Incorrect transaction code

C05 is used in a Notification of Change when the transaction code (indicating account type and credit/debit) in the entry is incorrect.

Question 14: BSA/AML requirements that apply to ACH transactions include:

Monitoring for suspicious activity and filing SARs when warranted (Correct answer)
Reporting all ACH entries to FinCEN on a daily basis
Obtaining NACHA approval for all high-value ACH entries
Filing a CTR for every ACH transaction exceeding $10,000

Correct answer: Monitoring for suspicious activity and filing SARs when warranted

Financial institutions must monitor ACH transactions for suspicious activity patterns and file Suspicious Activity Reports (SARs) with FinCEN when warranted under BSA requirements.

Question 15: Excessive administrative return rates (R02, R03, R04) for an Originator may indicate:

A requirement to file a CTR with FinCEN for each returned entry
Loss of settlement rights at the ODFI level
An automatic trigger for NACHA suspension of the Originator
Data quality problems or potential fraud in the Originator's account database (Correct answer)

Correct answer: Data quality problems or potential fraud in the Originator's account database

High administrative return rates suggest the Originator's account database is inaccurate or outdated, which may also be a fraud indicator requiring ODFI investigation.

Question 16: Which of the following best describes an ACH "batch"?

A set of ACH entries scheduled for future processing
A collection of return items from various RDFIs
A group of ACH transactions submitted together for processing (Correct answer)
A single transaction processed by the ACH Operator

Correct answer: A group of ACH transactions submitted together for processing

In the ACH Network, a "batch" refers to a collection of individual ACH entries (transactions) that are grouped together by an Originator or ODFI and submitted as a single file for processing. This batching mechanism allows for the efficient processing of multiple transactions simultaneously, such as a company's payroll direct deposits or a utility company's bill payments, rather than sending each entry individually.

Question 17: The administrative return rate threshold (R02, R03, R04) that triggers NACHA review of an Originator is:

3% of ACH debit entries originated (Correct answer)
0.5% of ACH debit entries originated
15% of ACH debit entries originated
1% of ACH debit entries originated

Correct answer: 3% of ACH debit entries originated

An administrative return rate exceeding 3% triggers NACHA review, indicating the Originator's account database has significant data quality issues.

Question 18: Under NACHA rules, an ODFI's annual risk assessment must include:

Submitting a formal risk report to both NACHA and the Federal Reserve
Conducting individual audits of all consumer Receiver accounts
Filing a Suspicious Activity Report for each high-risk Originator
Evaluating the ACH risk of each Originator and Third-Party Sender relationship (Correct answer)

Correct answer: Evaluating the ACH risk of each Originator and Third-Party Sender relationship

NACHA requires ODFIs to perform annual risk assessments that evaluate the ACH-related risks posed by each Originator and Third-Party Sender relationship.

Question 19: Stop payment requests from consumers regarding ACH debits must be honored by the RDFI if received:

In time to allow a reasonable opportunity to act before the scheduled debit (Correct answer)
30 days in advance of the debit date
Only if submitted in writing to the RDFI branch
At least 3 banking days before the scheduled debit

Correct answer: In time to allow a reasonable opportunity to act before the scheduled debit

Under Regulation E and NACHA rules, the RDFI must honor a stop payment request if it is received in time for the institution to have a reasonable opportunity to act on it.

Question 20: Under Regulation E, a financial institution's error resolution process must be completed within:

60 calendar days as the maximum allowed period
10 business days (or 45 calendar days if provisional credit is extended to the consumer) (Correct answer)
2 business days in all cases
5 business days regardless of circumstances

Correct answer: 10 business days (or 45 calendar days if provisional credit is extended to the consumer)

Regulation E requires institutions to investigate and resolve error claims within 10 business days, or up to 45 calendar days if they provisionally credit the disputed amount while investigating.

Question 21: How is a Third-Party Sender (TPS) defined under NACHA Operating Rules?

A federal reserve bank that clears ACH entries
A direct customer of an ODFI with its own origination agreement
A company that transmits ACH entries on behalf of Originators through an ODFI (Correct answer)
An ACH network operator that settles transactions

Correct answer: A company that transmits ACH entries on behalf of Originators through an ODFI

A Third-Party Sender is an intermediary that transmits ACH entries to an ODFI on behalf of Originators, often providing processing services for multiple clients.

Question 22: A Notification of Change (NOC) is sent by an RDFI when:

An Originator requests account verification before sending entries
Account information has changed but the entry was still successfully posted (Correct answer)
A Receiver formally disputes a transaction with the RDFI
An entry is returned for insufficient funds

Correct answer: Account information has changed but the entry was still successfully posted

An NOC is sent when the RDFI posts an entry successfully but detects that certain account information (e.g., account number or routing number) needs to be corrected for future entries.

Question 23: Which entity is responsible for receiving ACH entries and posting them to Receiver accounts?

RDFI (Receiving Depository Financial Institution) (Correct answer)
Third-Party Sender
Originator
ACH Operator

Correct answer: RDFI (Receiving Depository Financial Institution)

The RDFI receives ACH entries from the ACH Operator and posts them to the Receiver's account.

Question 24: CTX entries differ from CCD entries primarily because CTX:

Is limited to credit entries only
Is used only for consumer deposit accounts
Requires same-day settlement by rule
Supports up to 9,999 addenda records for corporate trade exchange data (Correct answer)

Correct answer: Supports up to 9,999 addenda records for corporate trade exchange data

CTX (Corporate Trade Exchange) supports up to 9,999 addenda records, allowing detailed remittance information to accompany business-to-business payments.

Question 25: A reversing entry must be transmitted within how many banking days after the original entry's settlement date?

2 banking days
60 calendar days
5 banking days (Correct answer)
Same banking day

Correct answer: 5 banking days

Under NACHA rules, a reversing entry must be sent within 5 banking days of the original entry's settlement date.

Question 26: Which one of the following risk control techniques will reduce loss severity and make losses more predictable, without increasing loss frequency? Choose one answer.

Duplication (Correct answer)
Diversification
Separation
Loss prevention

Correct answer: Duplication

Duplication is a risk control technique that involves creating backup copies of critical assets, data, or operations and storing them in a separate location. This strategy primarily reduces loss severity because if the primary asset is damaged or destroyed, the duplicate can be quickly utilized to restore functionality. It also makes losses more predictable by ensuring continuity, without necessarily influencing the frequency of the initial loss event.

Question 27: For PPD debit entries, the written authorization obtained by an Originator must be:

Authorization provided exclusively through an online portal
Clear, readily understandable, and contain the payment amount, schedule, and Receiver's account information (Correct answer)
Any signed document from the Receiver, regardless of content
Verbal authorization recorded and retained on file

Correct answer: Clear, readily understandable, and contain the payment amount, schedule, and Receiver's account information

NACHA rules require that PPD debit authorizations be clear, readily understandable, and include key terms such as the payment amount, frequency, and start date.

Question 28: In ACH operations, what does "settlement" refer to?

The process of reconciling accounts within a financial institution
The posting of account balances on customer statements
The process of clearing checks
The movement of funds between banks to complete an ACH transaction (Correct answer)

Correct answer: The movement of funds between banks to complete an ACH transaction

In ACH operations, 'settlement' refers to the final movement of funds between financial institutions to complete an ACH transaction. It is the process by which the actual money is exchanged between the banks involved, typically occurring through the Federal Reserve or a private clearing house. Settlement confirms that the funds have been successfully transferred and are available in the receiving account.

Question 29: Risk is a term that is regularly used and that is generally understood in context. As used in this discussion, which one of the following is one of the two elements within the definition of risk?

Opportunity for profit
Uncertainty of outcome (Correct answer)
Probability of financial loss
Likelihood of injury or damage to property

Correct answer: Uncertainty of outcome

In the context of risk management, risk is fundamentally defined by two key elements: uncertainty of outcome and the possibility of a negative deviation from what is expected. Uncertainty refers to the unpredictability of whether a particular event will occur and what its consequences might be. This inherent unpredictability is what makes risk a central concern for organizations, necessitating management strategies.

Question 30: After identifying and analyzing loss exposures and evaluating and selecting the appropriate risk management techniques, the next step in the risk management process is to Choose one answer.

Implement the selected techniques. (Correct answer)
Decide on risk financing techniques.
Monitor the results.
Revise the risk management program.

Correct answer: Implement the selected techniques.

The risk management process follows a logical sequence to effectively address potential losses. After identifying and analyzing loss exposures, and subsequently evaluating and selecting the most appropriate risk management techniques (both control and financing), the next crucial step is to put these chosen strategies into action. This implementation phase involves executing the selected techniques, such as purchasing insurance, installing safety measures, or establishing contingency plans, before their effectiveness can be monitored.

Accredited ACH Professional (AAP)

The AAP certification validates expertise in ACH network operations, rules and regulations, risk management, file formatting, and other payment systems. It is administered by Nacha and recognized as the premier credential for ACH payments professionals.

Questions

45 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds